k8s_argocd_with_keycloak: False
argocd_server_admin_password: "{{ argocd_server_admin_password_vault }}"

k8s_argocd_helm__name: "argo-cd"
k8s_argocd_helm__release_namespace: "argo-cd"

gpg_key_smardigo_automation__private: '{{ gpg_key_smardigo_automation__private__vault }}'

# https://github.com/argoproj/argo-helm/tree/master/charts/argo-cd
k8s_argocd_helm__release_values:
  controller:
    logLevel: info
    logFormat: json
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: "{{ k8s_argocd_helm__release_namespace }}"
        additionalLabels:
          release: prometheus
  repoServer:
    logLevel: info
    logFormat: json
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: "{{ k8s_argocd_helm__release_namespace }}"
        additionalLabels:
          release: prometheus
    env:
      - name: ARGOCD_MAX_CONCURRENT_LOGIN_REQUESTS_COUNT
        value: "0"
      - name: ARGOCD_EXEC_TIMEOUT
        value: "300s"
      - name: XDG_CONFIG_HOME
        value: /.config
      - name: GNUPGHOME
        value: /home/argocd/.gnupg
    volumes:
      - name: custom-tools
        emptyDir: {}
      - name: gnupg-home
        emptyDir: {}
      - name: sops-gpg
        secret:
          secretName: sops-gpg
    volumeMounts:
      - mountPath: /home/argocd/.gnupg
        name: gnupg-home
        subPath: .gnupg
      - mountPath: /usr/local/bin/kustomize
        name: custom-tools
        subPath: kustomize
        # Verify this matches a XDG_CONFIG_HOME=/.config env variable
      - mountPath: /.config/kustomize/plugin/viaduct.ai/v1/ksops/ksops
        name: custom-tools
        subPath: ksops
    initContainers:
      - name: 1-install-ksops
        image: viaductoss/ksops:v3.0.1
        command: ["/bin/sh", "-c"]
        args:
          - echo "Installing KSOPS...";
            mv ksops /custom-tools/;
            mv $GOPATH/bin/kustomize /custom-tools/;
            echo "Done.";
        volumeMounts:
          - mountPath: /custom-tools
            name: custom-tools
      - name: 2-import-gpg-key
        image: argoproj/argocd:v2.2.5
        command: ["gpg", "--import","/sops-gpg/gpg_key_smardigo_automation__private"]
        env:
          - name: GNUPGHOME
            value: /gnupg-home/.gnupg
        volumeMounts:
          - mountPath: /sops-gpg
            name: sops-gpg
          - mountPath: /gnupg-home
            name: gnupg-home
  server:
    logLevel: info
    logFormat: json
    config:
      kustomize.buildOptions: "--enable-alpha-plugins"
    rbacConfig:
      policy.default: role:readonly
      policy.csv: |
        g, {{ argo_realm_group }}, role:admin
        g, admin, role:admin
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: "{{ k8s_argocd_helm__release_namespace }}"
        additionalLabels:
          release: prometheus
    service:
      sessionAffinity: ClientIP
    ingress:
      enabled: true
      annotations:
        cert-manager.io/cluster-issuer: letsencrypt-prod
        cert-manager.io/issue-temporary-certificate: "true"
        kubernetes.io/ingress.class: nginx
        nginx.ingress.kubernetes.io/whitelist-source-range: "{{ ( ip_whitelist + ip_whitelist_admins ) | join(',') }}"
        nginx.ingress.kubernetes.io/force-ssl-redirect: "false"
        nginx.ingress.kubernetes.io/ssl-passthrough: "true"
        nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
      hosts:
        - "{{ k8s_argocd_helm__domain }}"
      tls:
        - secretName: "{{ stage }}-kube-argocd-cert"
          hosts:
            - "{{ k8s_argocd_helm__domain }}"
    additionalProjects:
    - name: infrastructure
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      additionalLabels: {}
      additionalAnnotations: {}
      description: infrastructure applications
      sourceRepos:
      - '*'
      destinations:
      - namespace: '*'
        server: https://kubernetes.default.svc
      clusterResourceWhitelist:
      - group: '*'
        kind: '*'
      orphanedResources:
        warn: false
    - name: bootstrap
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      additionalLabels: {}
      additionalAnnotations: {}
      description: application declarations for bootstraping k8s cluster with argo-cd
      sourceRepos:
      - '*'
      destinations:
      - namespace: '*'
        server: https://kubernetes.default.svc
      clusterResourceWhitelist:
      - group: '*'
        kind: '*'
      orphanedResources:
        warn: false
    - name: cus-mobene
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      additionalLabels: {}
      additionalAnnotations: {}
      description: application declarations for customer mobene
      sourceRepos:
      - '*'
      destinations:
      # TODO all applications have to be in argo-cd namespace
      - namespace: 'argo-cd'
        server: https://kubernetes.default.svc
      - namespace: 'cus-mobene'
        server: https://kubernetes.default.svc
      - namespace: 'cus-mobene-nsodev'
        server: https://kubernetes.default.svc
      - namespace: 'cus-mobene-cusqa'
        server: https://kubernetes.default.svc
      - namespace: 'cus-mobene-cusprod'
        server: https://kubernetes.default.svc
      clusterResourceWhitelist:
      - group: '*'
        kind: '*'
      orphanedResources:
        warn: false
    additionalApplications:
    -
      name: keycloak
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      destination:
        namespace: sma-ums
        server: https://kubernetes.default.svc
      project: bootstrap
      source:
        path: config/kustomize/prodwork01
        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/k8s_keycloak.git
        targetRevision: prod
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
        - CreateNamespace=true
    -
      name: filebeat
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      destination:
        namespace: kube-system
        server: https://kubernetes.default.svc
      project: bootstrap
      source:
        path: config/prodwork01
        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/kube-system-filebeat.git
        targetRevision: main
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
        - CreateNamespace=true
    -
      name: cus-mobene
      namespace: '{{ k8s_argocd_helm__release_namespace }}'
      destination:
        namespace: cus-mobene
        server: https://kubernetes.default.svc
      project: cus-mobene
      source:
        path: config/default
        repoURL: https://{{ shared_service_gitea_hostname }}/argocd/smardigo-mobene.git
        targetRevision: main
      syncPolicy:
        automated:
          prune: true
          selfHeal: true
        syncOptions:
        - CreateNamespace=true
  redis:
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
        namespace: "{{ k8s_argocd_helm__release_namespace }}"
        additionalLabels:
          release: "{{ k8s_prometheus_helm__name }}"
  dex:
    enabled: false
  applicationSet:
    enabled: false
  configs:
    secret:
      argocdServerAdminPassword: '{{ argocd_server_admin_password | password_hash("bcrypt") }}'
